1. Field of Invention
This invention relates to a security module and more particularly to a method of controlling the operation of security modules.
Essentially, a security module, which is sometimes referred to as a tamper-resistant module, includes a physically secure housing containing processing means and storage means for storing sensitive data. An attempt to tamper with the security module, for example, by attempting to break open or drill through the housing results in the resetting of the storage means which stores the sensitive data.
Security modules have found application in data processing systems and networks where a high degree of security is important. Such applications include electronic payment systems, electronic funds transfer (EFT) systems, data encryption and decryption, PIN (personal identification number) verification, access control and home banking.
2. Description of the Prior Art
U.S. Pat. No. 4,593,384 discloses a security module which includes a ceramic housing formed of six parts connected together and which contains a processor and a resettable shift register for storing sensitive data. Each part of the housing is provided with a pair of conductive path portions disposed in superposed layers and having complementary zig-zag configurations. The conductive path portions on the housing parts are interconnected to form first and second conductive paths. Interruption of either conductive path, or a short circuit between the two paths, resulting from an attempt to break into the housing, causes a reset signal generator to provide a reset signal to erase the contents of the resettable shift register. A temperature sensor circuit responsive to the temperature in the housing falling below a predetermined level also causes the reset signal generator to provide a reset signal to reset the resettable shift register. The known security module contains a programmable read-only memory (PROM) which stores the firmware for the security module, that is, the software program to be executed by the processor.
U.S. patent application, Ser. No. 877,049, filed June 23, 1986, now U.S. Pat. No. 4,691,350, discloses a security module in which each part of a ceramic housing includes two layers of wire mesh are which electrically connected to make one circuit together with a conductive sheet placed between the layers producing a reset signal if the circuit is interrupted or shorted to the conductive sheet.
U.S patent application, Ser. No. 877,907, filed June 24, 1986, now U.S. Pat. No. 4,811,288, discloses a security module in which each part of a ceramic housing includes two layers of wire mesh formed by a conductive thin film applied to the inner surface of each part.
U.S. patent application, Ser. No. 058,730, filed June 5, 1987, now U. S. Pat No. 4,807,284, discloses a security module in which each part of a ceramic housing has applied to its inner surface by thick film deposition techniques a conductive path segment.
The known security modules have the disadvantage of lacking operational flexibility. Thus, since the functionality of the known security modules is determined by the firmware stored in the PROM and since the PROMs generally are programmed by special PROM programmer devices in an irreversible manner, once the known security modules have been assembled and closed with the PROM enclosed therein, changes to the functionality of the known security modules are no longer possible. Such changes are desirable if the system in which the security module is being used is required to be upgraded or enhanced.
It is thus an object of the present invention to provide a method of controlling the operation of a security module, which ennables such modules to have a high degree of operational flexibility.